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f5 BACKGROUND OF THE INVENTION 

y The present invention relates to controls that operate transducers. In 

m particular to controls that operate transducers that if erroneously active may 
g result in hazardous operation but are always safe when inactive. In this 
m application, a transducer is a device whose function is to turn the electrical 
20 energy into some other energy form. As the operation of the transducers may 

also be suspended by external switches or circuits the present invention is related 
to devices that include override(s). 

Controls operate transducers using switching means hereinafter referred to 
as a switch, that may be a switch, relay, transistor, other solid state switch, or 
25 the like. Controls use either open or closed loop systems. In an open loop 

system any failure of switch goes undetected. True closed loop systems monitor 
the output of transducers, indirectly this may react to a switch in an erroneous 
state after the fault affects output but it is an expensive and less reliable means to 
detect switch failures. Further unless the feedback results in opening every 
30 switch in a transducer circuit, a switching failure(s) can still produce erroneous 

1 



operation while the circuit still has a functional switch since the faulty switch(s) 
could be the one the feedback uses to alter operation. 

U.S. Pat. No. 5,760,493 addresses the problem of improper transducer 
operation in appliances. The method does not detect faults. The intention of 
5 U.S. Pat. No. 5,760,493 is to limit improper transducer operation should one of 
its switches fail. In this approach two switches must be closed to permit 
transducer operation. If one switch shorts the transducer is erroneously active 
when the functional switch is closed to operate another transducer. This method 
only prevents improper operation during part of a cycle. Since faults are not 

10 detected, operation continues allowing the possibility of additional faults 

^ developing, further compromising safe operation. 

S U.S. Pat. No. 5,760,493 points out that switching faults are not uncommon 

*[ when driving large inductive loads. The appliance industry has relied on a 
JS plurality of switches to ensure that operation of transducers is stopped at least at 
|| the end of a cycle. This plurality of switches includes overrides which directly 
^ switch the transducers. However the plurality of switches adds to the cost and 
fll reduces overall system reliability. 

ill U.S. Pat. No. 4,866,955 uses switching means to prevent an appliance from 

r: operating if its door or lid switch or has not been opened since the end of the last 
20 cycle. The intended state of the switch is not known, it is assumed that the 

switch must open between cycles. The control is therefore incapable of stopping 
the appliance should the switch fail to open as intended during a cycle. 

The prior art shown in U.S. Pat. Nos. 3,367,089, 4,307,392, 4,951,037, 
shows methods of detecting switching faults that affect transducers. The 
25 transducers are display elements. U.S. Pat. Nos. 4,307,392 and 4,951,037 

determine the functionality of the transducer and any fault causing any switch to 
be in an erroneous state. U.S. Pat. No. 3,367,089 only detects faults affecting 
the switches. These approaches apply only to switching means operated solely by 
the control. 
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The application of transducers in these patents can produce unsafe 
conditions when erroneously unenergized. For this reason the methods in these 
patents seek to detect erroneously unenergized transducers in addition to 
detecting erroneously energized transducers. Additionally patents 4,307,392 and 
5 4,951,037 seek to verify the functionality of the transducer. These are burdens 
the present invention does not share. In the applications of the present invention 
a fault in the switching means or its transducer causing it to be inactive does not 
pose a safety hazard. 

In the display verification patents no method is presented to automatically 
10 stop hazardous transducer operation. The approach is to signal the operator that 

a fault has been found to prevent a fault from causing a hazard. If the operator 
p. does not receive the fault indicating signal, operation remains potentially unsafe. 

fe=? 

W While the control of the present invention may signal the operator that a fault has 

Jp been detected, if the operator fails to observe this signal operation is still safe 

1|5 because the control halts transducer operation. 

fil DESCRIPTION OF DRAWINGS 

m Figure 1 is a schematic of the control interfacing to the ac source and 

^ motor. 

20 Figure 2 is a schematic of the circuits used to drive the dc valves. 

Figure 3 shows the signals produced on the control inputs connected to ac 

nodes. 

SUMMARY OF INVENTION 

25 The present invention is a control with means to verify the switches in the 

energizing circuitry of transducer(s) are in the intended state. If a fault is 
detected, the control automatically uses another switch to open the affected 
circuit to prohibit the transducer from being erroneously energized. Improper 
transducer activation is prevented not just limited. While the control may 

30 attempt to signal the operator of a fault, hazardous operation is suspended 
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without requiring operator knowledge of the fault. The present invention can 
detect faults in any switch, including externally operated switching, as long as the 
intended state of the switch is known to the control. 

While commonly either on or off, variable switching is included as long as 
5 the control can determine when a transducer is unenergized (switch open). The 
signal to have a switch open a transducer circuit may originate at: 1) the control. 
2) an override. 3) either the control or an override. When the scan of a switch 
indicates it is in the wrong state, another switch is employed to stop and/or 
prevent current to the transducer. 
10 Failures in the switch itself, in the interfacing of the control or an override 

u to that switch, or an incorrectly open or shorted path in the energizing circuitry 
]= can cause the switch to be non-functional. Scanning the energizing circuitry 
ffl allows the control to detect non-functional switches regardless of the cause. 

ru 

B p As long as one control operated switch in a circuit is functional the 

f; =W 

jE5 control is able to prevent operation of the transducer(s) in a faulty circuit. The 
^ scanning methods included and introduced in an application filed concurrently by 
flj the same inventor are very inexpensive. In many cases one resistor connecting a 
III single digital input to a node common to similar transducers allows the control to 
r! verify the state of the switches for a plurality of transducers. 
20 The preferred implementation of an override is to share with the control a 

monitored transducer switch(s) that either can open regardless of the 
functionality of the other. The ability of an override to stop operation 
independently of the control is maintained and the control can signal the switch 
to open at anytime to verify its functionality. Fewer load switches lower cost and 
25 increase reliability. Further the control can monitor the override input to the 
transducer switch, should the primary load switch fail to open as the override 
dictates, the control opens the transducer circuit with a backup switch(s). 

Generally the only non-functional switches the control must detect are 
erroneously closed. An exception is when the switch(s) of a transducer circuit 
30 determines the polarity of the voltage across a transducer. If the state of any 
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switch permits an incorrect voltage to be present at the transducer the control 
opens a switch(s) ensuring the transducer can not be energized. 

The control can also open a transducer circuit when the frequency at which 
an externally operated switch changes state rather than the state itself can lead to 
5 hazardous operation. The control extends the period the transducer circuit is 
open reducing the switching rate. This prevents damage to the switch and/or the 
transducer. 

DESCRIPTION OF PREFERRED EMBODIMENT 
10 Although the following embodiment is a commercial washing machine 

P employing relays to switch a 120vac motor and transistors to switch 24v valves it 
is to be understood that the inventor contemplates the invention being applied to 
other devices with the same or different transducers and switching means 

m operating off various voltages. 

;15 In the preferred embodiment the control scans the circuitry used to 

y energize the +24v solenoid valves Pl-5 and the 120vac motor 60 of a commercial 
fU washing machine the control operates. If a fault in the circuitry is found that 
q could cause a valve or the motor to be erroneously energized, the control uses 

another switch to open or keep open the faulty circuitry until it is repaired. Then 
20 the control signals the operator that the washer requires service. 

The motor drive circuitry is shown in Figure 1 and the valve drive circuitry 
is shown in Figure 2. In addition to the valves and motor, the washer includes a 
power supply 10 that produces +24v, +5v relative to ground that is in common 
with ac source ground. The switches of the energizing circuitry in this 
25 embodiment include the output transistors of U2, transistor T2, relays K1-K4, 
centrifugal switch S3 and thermal limit switch S4. 

Switches S1-S4 are overrides. Switches S3-S4 directly switch the motor. 
Pressure switch SI shares operation of T2 with the control enabling either to 
open the valves P1-P5. The pressure switch SI is closed until the fill level is 
30 reached. The lid switch S2 shares operation of Kl with the control enabling 
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either to stop the motor. S2 is closed when the lid of the washer is closed. The 
motor start switch S3 ensures the HIGH and START windings are energized to 
start the motor, it opens shortly after the motor starts. The thermal switch S4 is 
closed unless the motor overheats. 
5 The motor is switched using relays K1-K4. Figure 1 shows the interfacing 

of the control to the ac source and the motor. The thermal limit switch S4 and 
both Kl and K2 must close to turn on the motor. Kl is the switching relay 
responsible for starting and stopping the motor. K2 is the safety relay and serves 
as the backup switch for Kl. Both Kl and K2 are protected by varistor V2 to 
10 limit arcing when either is opened. 

g The speed of the motor is determined by K3. When K3 is energized the 

D motor will run in HIGH. When K3 is unenergized the motor will start in HIGH 
fy and run in LOW once the centrifugal switch S3 opens shortly after the motor 
J starts. The direction the motor turns is determined by the polarity of the 
HB connections made by K4 though CI and S3 to the START winding. When K4 is 

is 

O energized the washer will agitate. When K4 is off the washer will spin. When 

fti 

fjj the motor reaches speed, the centrifugal switch S3 opens the START winding 
zJ circuit and switches the motor speed to LOW if K3 is unenergized. 
m The control uses the npn transistor driver IC U2 to turn on K2, K3 and 

20 K4. The coil of each of these relays has a direct connection to +24v. Ql 
connects K2 to ground when RC7 takes Dl high. Q2 connects K3 to ground 
when RC6 takes D2 high. Q3 connects K4 to ground when RC5 takes D3 high. 
The control only partially controls the operation of Kl. The connection of Kl to 
+24v is made through T7. Ul turns on T7 by turning on T5 through R5. When 
25 on, T5 takes the common node of R7, R6 and T7 low enough to turn on T7. The 
connection of Kl to ground is made directly by the lid switch S2 and/or by Q3 
through D13. The diode D14 protects S2, diode D9 protects T7 and the internal 
diodes of U2 protect its output transistors when the coils of the relays are turned 
off. 
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To start the washer in agitate Q3 connects K4 to ground. In agitate Q3 
also connects the coil of Kl to ground through D13 In agitate opening the lid 
switch S2 has no effect on the operation of the washer. To start the washer in 
spin Q3 disconnects K4 from ground and leaving S2 as the sole connection of Kl 
5 to ground. In spin if S2 opens Kl will open stopping the motor regardless of the 
state and functionality of Ul and T7. 

The control verifies the state of the ac switches Kl, K2 and K4. The 
sensing means for the relays also determines the state of the thermal switch S4. 
If the thermal switch S4 is open the control suspends operation until the motor 
10 cools sufficiently to close S4. If Kl or K2 is erroneously closed when the motor 

is off, the control will not close the other until repairs have been made. If Kl 
g fails to open as intended by the control or the lid switch S2, the control opens K2 
r=j stopping the motor until repairs are made. The state of K4 is verified to ensure 
=p that the motor is started in the proper direction. If the connections to the 
||5 START winding are not at the proper voltages during start up the control opens 
Kl to stop the motor. 

Jj The signals on RA0-RA2 produced by the connections through R2, R8 and 

H R9 respectively are used to determine the state of the ac switches. The ac nodes 
Si driving these inputs are in one of three states - LI, Neutral or floating. A node 
20 at LI produces the truncated 60hz sine wave in Figure 3A. A floating node is 

taken high by the pull-up resistor (Rl, Rll or R12) on its input producing the 

signal in Figure 3B. A Neutral node produces a low input signal in Figure 3C. 

The resistance of each connection is sufficient to allow the input protection 

diodes of inputs RA0-RA2 and RTCC to limit the signals to +5.6v and -.6v, a 
25 safe range for Ul. The input RTTC is connected to LI through RIO producing 

the signal in Figure 3A. 

Before the functionality of switches at least partially operated by the 

control can be verified, the control verifies that the override switch S4 is closed. 

When S4 is closed either RA1 or RA2 (or both RA1 and RA2 when either Kl or 
30 K2 is open) will have the signal produced by a Neutral node - Figure 3C. When 
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S4 is open neither RA1 or RA2 has the signal in Figure 3C since there is no 
connection to Neutral. To verify that S4 is closed RA1 and RA2 are read when 
RTCC goes high. If at least one is low, S4 is closed since only a Neutral node is 
low when RTCC is high. 

With S4 closed, the control scans the state of Kl, K2 and K4. To verify 
the states of Kl and K2 the control reads the signal on RAO through R2. Before 
a cycle is started the ac node sensed by RAO is floating if Kl and K2 are open as 
expected. Rl pulls RAO high when the ac node is floating (Figure 3B). IfK2 
alone has shorted the ac node connected to RAO is at Neutral producing the 
signal in 3C. If Kl is closed the ac node is at LI producing the 60hz signal in 
Figure 3 A. The control reads RAO when RTCC goes low, if RAO is high both 
Kl and K2 are open. If it is low there is a fault and the control will not close 
Kl or K2 to start a cycle until repairs are made. 

The control also checks the state of the switching relay Kl each time the 
motor is stopped. Kl is opened by the control to stop the motor as required 
during a cycle or by the opening of the lid switch S2 when the motor is rotating 
in the spin direction. The control reads the state of S2 on RBI through R3. In 
spin R4 pulls RBI high if S2 is open. The state of Kl is verified each time either 
the control or S2 attempts to open it. If Kl has opened the signal on RA1 is 
pulled low through K2 by the connection of the motor to Neutral. If RAO is not 
low when RTCC goes high the control opens K2 stopping the motor until repairs 
can be made. 

The control also monitors the connections of K4 to the START winding to 
verify the motor will rotate in the correct direction. In the operation of this 
washer it is critical that the motor stops if S2 is opened during spin. If a fault 
causes the START winding to have the incorrect voltage when the motor is 
started the washer could be in spin when the control intends for it to be in 
agitate. In this state the motor would not stop when S2 is opened during this 
erroneous spin since S2 has no effect on the motor in agitate. 
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To start the motor in agitate, K4 is energized. When functioning correctly 
the ac node sensed by RA1 is at LI and the ac node sensed by RA2 is at Neutral 
producing the signals in Figures 3A and 3C respectively. When RTCC goes high 
RA1 should be high and RA2 should be low. When RTCC goes low both RA1 
5 and RA2 should be low. If either of these conditions are not met the control 
stops the operation of the motor by opening Kl using K2 as backup until repairs 
are made. 

The method shown to scan the ac circuitry depends on the sharing of 
ground between the source and the supply. In consumer appliances the common 
10 ground approach is generally not employed. An application filed concurrently by 
If the same inventor provides a cost effective method of sensing ac path states, 
O including paths containing switches, when the control is floating relative to the ac 
Jj source. 

Jj In addition to monitoring the state of Kl and K2 the control monitors the 

Jfe frequency at which the Kl is switched in spin by S2. Should the rate of 
q switching become destructive, the time Kl is open is prolonged by taking RBO 
j|j low turning off T7. This breaks the connection of Kl to +24v preventing the 

motor from restarting when S2 is closed. After pausing to allow the contacts of 
fU Kl to cool RBO goes high turning on T7 allowing normal operation to resume. 
20 The rate is monitored by reading RAO whenever RTCC is high. If Kl is open 

RAO is low if Kl is closed RAO is high. The frequency at which Kl is switched 

by S2 can also be indirectly monitored by reading the input RBI. 

The valves are switched using transistors as shown in Figure 2. Transistor 

T2 completes the valve connections to +24v. The npn transistors of U2 outputs 
25 Q8-Q4 complete the valve connections to ground. D10 protects T2 when it 

switches the valves. U2 has internal protection diodes on its outputs to protect 

it. 

To energize a valve, both T2 and the corresponding output line of U2 
(Q8-Q4) must be switched on. If the control detects a short of T2 to +24v or a 
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short of any valve line Q8-Q4 to ground the control will use the functional 
transistor(s) to open or keep open valve circuitry until repairs can be made. 

Q8 switches the hot valve PI, Q7 switches the detergent valve P2, Q6 
switches the fabric softener valve P3, Q5 switches the cold valve P4, and Q4 
5 switches the bleach valve P5. Outputs Q8-Q4 are turned on when Ul take inputs 
D8-D4 high using RC0-RC4. 

R15 turns off T2 if SI is open or T3 is off. T2 is on when the path from 
its base to ground through SI, R17 and T3 is complete. Ul turns on T3 through 
R18 by taking RB4 high. When SI opens, a functional T2 opens regardless of 
10 the functionality of the rest of the control. 

M= The state of the valve switches, T2 and Q8-Q4, are scanned using input 

p RB2 through R34. The resistance of R34 is sufficient to permit the input 
S protection diodes of Ul to limit the input voltage on RB2 to +5.6v. The scan 
4] detects any fault causing T2 or Q8-Q4 to be erroneously on. If a short is 
JE5 detected when the valves are inactive the control will not start a fill keeping the 
q functional transistor(s) off. The switches are also scanned at the end of a fill. 
jJH T2 is always used to turn off the valves for all dispensing. If T2 fails to open the 
Ul circuitry, U2 is cleared turning off Q4-Q8 deenergizing the valve(s). 
py Before a fill starts both T2 and the individual valve lines Q4-Q8 are off 

20 R14 pulls input RB2 high unless a U2 output drive(s) Q4-Q8 has shorted to 
ground pulling RB2 low indicating the failure. If no valve line has shorted to 
ground, the control turns on the valve line(s) to be used, pulling RB2 low unless 
T2 has shorted. If T2 has shorted to +24v, RB2 would remain high. 

When a fault is detected the control will not start a fill cycle. For the 
25 transistors energizing the valves or their selection means to cause flooding, both 
T2 and a U2 output would have to short to their respective supply voltage 
between scans since the control will open the valves using the other transistor at 
the first failure. 

The functionality of the valve switches is also checked when the fill is 
30 complete. A fill is complete when the pressure switch SI opens or when Ul takes 



RB4 low turning off T3 to end a timed dispense. For a measured fill the control 
reads the state of SI on RB3 through R16. The resistance of R16 is sufficient to 
permit the input protection diodes to limit the input voltage on RB3 to + 5.6v. 
R16 also prevents a fault shorting RB3 to ground from turning on T2 When SI 
opens during a fill RB3 goes low. In either type of fill, the valve(s) are switched 
off when the base to ground connection of T2 is broken by opening either SI or 
T3. When T2 opens RB2 should be low. If not the control clears U2 turning off 
Q4-Q8 

While the pressure switch SI could also be monitored for destructive 
switching as is done with S2 5 T2 is much less likely to fail due to switching rate 
and given the hysteresis of the pressure switch SI it is unlikely to be switched at 
an excessive rate. 

While the embodiment present employs only one backup switch per 
transducer it is within the scope of this invention to include more. Further 
operation of the device can continue indefinitely or to a preferred time such as 
the end of a cycle after a fault is found by using a backup switch to perform the 
function of the failed one. With multiple backups operation can continue until 
only one functional switch remains. 

Alternatively upon detection of a fault the control can trigger a fuse or 
circuit breaker to open, permanently stopping transducer operation until repairs 
are made. 
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